Linux Kernel net/vmw_vsock/af_vsock.c vsock_connect memory leak

A vulnerability was found in Linux Kernel. It has been declared as problematic. This vulnerability affects the function vsock_connect of the file net/vmw_vsock/af_vsock.c. The manipulation leads to memory leak. Using CWE to declare the problem leads to CWE-401. The weakness was published 10/21/2022 as DLA 3173-1. The advisory is available at git.kernel.org. This vulnerability was named CVE-2022-3629. Access to the local network is required for this attack. Technical details are available. There is no exploit available. The structure of the vulnerability defines a possible price range of USD $0-$5k at the moment. It is declared as not defined. As 0-day the estimated underground price was around $5k-$25k. The bugfix is ready for download at git.kernel.org. It is recommended to apply a patch to fix this issue. A possible mitigation has been published even before and not after the disclosure of the vulnerability.

Timeline

The analysis of the timeline helps to identify the required approach and handling of single vulnerabilities and vulnerability collections. This overview makes it possible to see less important slices and more severe hotspots at a glance. Initiating immediate vulnerability response and prioritizing of issues is possible.

User

1	41

Field

exploit_price_0day	2
software_component	2
vulnerability_cvss3_meta_tempscore	2
vulnerability_cvss3_meta_basescore	2
vulnerability_cvss3_cna_basescore	1

Commit Conf

90%	34
70%	20
50%	12
100%	1

Approve Conf

90%	34
70%	20
80%	12
100%	1

ID	Commited	User	Field	Change	Remarks	Accepted	Status	C
13474066	01/03/2023	VulD...	price_0day	$5k-$25k	see exploit price documentation	01/03/2023	accepted	90
13474065	01/03/2023	VulD...	component			01/03/2023	accepted	100
13282602	11/19/2022	VulD...	cvss3_cna_basescore	2.6	see CVSS documentation	11/19/2022	accepted	90
13282601	11/19/2022	VulD...	cvss3_nvd_basescore	3.3	nist.gov	11/19/2022	accepted	90
13282600	11/19/2022	VulD...	cvss3_meta_tempscore	2.8	see CVSS documentation	11/19/2022	accepted	90
13282599	11/19/2022	VulD...	cvss3_meta_basescore	2.8	see CVSS documentation	11/19/2022	accepted	90
13282598	11/19/2022	VulD...	cve_cna	VulDB	nvd.nist.gov	11/19/2022	accepted	70
13282597	11/19/2022	VulD...	cvss3_cna_a	L	nvd.nist.gov	11/19/2022	accepted	70
13282596	11/19/2022	VulD...	cvss3_cna_i	N	nvd.nist.gov	11/19/2022	accepted	70
13282595	11/19/2022	VulD...	cvss3_cna_c	N	nvd.nist.gov	11/19/2022	accepted	70
13282594	11/19/2022	VulD...	cvss3_cna_s	U	nvd.nist.gov	11/19/2022	accepted	70
13282593	11/19/2022	VulD...	cvss3_cna_ui	N	nvd.nist.gov	11/19/2022	accepted	70
13282592	11/19/2022	VulD...	cvss3_cna_pr	L	nvd.nist.gov	11/19/2022	accepted	70
13282591	11/19/2022	VulD...	cvss3_cna_ac	H	nvd.nist.gov	11/19/2022	accepted	70
13282590	11/19/2022	VulD...	cvss3_cna_av	A	nvd.nist.gov	11/19/2022	accepted	70
13282589	11/19/2022	VulD...	cvss3_nvd_a	L	nvd.nist.gov	11/19/2022	accepted	70
13282588	11/19/2022	VulD...	cvss3_nvd_i	N	nvd.nist.gov	11/19/2022	accepted	70
13282587	11/19/2022	VulD...	cvss3_nvd_c	N	nvd.nist.gov	11/19/2022	accepted	70
13282586	11/19/2022	VulD...	cvss3_nvd_s	U	nvd.nist.gov	11/19/2022	accepted	70
13282585	11/19/2022	VulD...	cvss3_nvd_ui	N	nvd.nist.gov	11/19/2022	accepted	70